Netis E1+ Information Disclosure Vulnerability Allowing WiFi Password Retrieval

An information disclosure vulnerability has been identified in the Netis E1+ router, specifically in version 1.2.32533. This vulnerability allows unauthenticated attackers to access WiFi passwords through the netcore_get.cgi endpoint. By sending a GET request to this endpoint, attackers can retrieve sensitive network information, including SSID and WiFi passwords, in plain text.

Impact

Exploitation of this vulnerability leads to unauthorized access to WiFi passwords and SSIDs, allowing attackers to connect to the affected wireless networks.

Reproduction

To reproduce this vulnerability, send a GET request to the netcore_get.cgi endpoint on a Netis E1+ router running version 1.2.32533. The response will include unencrypted WiFi passwords and SSIDs.